<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      YARA规则 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        YARA规则
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2022-08-13
      </span>

                                                                        <span class="post-pubtime"> 本文共2.6k字 </span>

                                                                        <span class="post-pubtime">
        大约需要17min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/Antivirus/" title="Antivirus">
            <b>#</b> Antivirus
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[toc]</p>
<h1 id="1-YARA简介"><a href="#1-YARA简介" class="headerlink" title="1.YARA简介"></a>1.YARA简介</h1><p>YARA 是一个旨在（但不限于）帮助恶意软件研究人员识别和分类恶意软件样本的开源工具。</p>
<p>YARA的每一条描述、规则都由一系列字符串和一个布尔型表达式构成，并阐述其逻辑。YARA规则可以与文件或在运行的进程，以帮助研究人员识别其是否属于某个已进行规则描述的恶意软件等。</p>
<blockquote>
<p>  项目地址：<a target="_blank" rel="noopener" href="https://github.com/VirusTotal/yara%EF%BC%8C%EF%BC%88yara64.exe">https://github.com/VirusTotal/yara，（yara64.exe</a> ， yarac64.exe ）</p>
<p>  python：<a target="_blank" rel="noopener" href="https://github.com/VirusTotal/yara-python">https://github.com/VirusTotal/yara-python</a></p>
<p>  官方文档：<a target="_blank" rel="noopener" href="https://yara.readthedocs.io/">https://yara.readthedocs.io/</a></p>
</blockquote>
<h1 id="2-YARA示例"><a href="#2-YARA示例" class="headerlink" title="2.YARA示例"></a>2.YARA示例</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">rule silent_banker : banker</span><br><span class="line">&#123;</span><br><span class="line">    meta:</span><br><span class="line">        description = <span class="string">&quot;This is just an example&quot;</span></span><br><span class="line">        thread_level = <span class="number">3</span></span><br><span class="line">        in_the_wild = <span class="literal">true</span></span><br><span class="line">    strings:</span><br><span class="line">        $a = &#123;<span class="number">6</span>A <span class="number">40</span> <span class="number">68</span> <span class="number">00</span> <span class="number">30</span> <span class="number">00</span> <span class="number">00</span> <span class="number">6</span>A <span class="number">14</span> <span class="number">8</span>D <span class="number">91</span>&#125;</span><br><span class="line">        $b = &#123;<span class="number">8</span>D <span class="number">4</span>D B0 <span class="number">2B</span> C1 <span class="number">83</span> C0 <span class="number">27</span> <span class="number">99</span> <span class="number">6</span>A <span class="number">4</span>E <span class="number">59</span> F7 F9&#125;</span><br><span class="line">        $c = <span class="string">&quot;UVODFRYSIHLNWPEJXQZAKCBGMT&quot;</span></span><br><span class="line">    condition:</span><br><span class="line">        $a <span class="keyword">or</span> $b <span class="keyword">or</span> $c</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>以上规则：</p>
<ol>
<li>名为<code>rule silent_banker</code>的规则，其中<code>banker</code>是规则的tag字段(可以有多个tag)</li>
<li><code>meta</code>字段是规则的描述信息，比如可以有规则说明、作者信息、威胁等级、在野情况、文件MD5、来源等内容；</li>
<li><code>strings</code>是规则字段</li>
<li><code>condition</code>则是条件判断的字段</li>
</ol>
<h1 id="3-yara规则"><a href="#3-yara规则" class="headerlink" title="3.yara规则"></a>3.yara规则</h1><blockquote>
<p>  官方文档：<a target="_blank" rel="noopener" href="https://yara.readthedocs.io/en/v4.2.3/writingrules.html">https://yara.readthedocs.io/en/v4.2.3/writingrules.html</a></p>
</blockquote>
<p>yara中的规则都以<code>rule</code>开头，后面跟着的是<code>identifier</code>（标识符），标识符和编程中的变量命名差不多，部分保留的关键字不能用作标识符：</p>
<table>
<thead>
<tr>
<th align="center"><strong>all</strong></th>
<th align="center"><strong>and</strong></th>
<th align="center"><strong>any</strong></th>
<th align="center"><strong>ascii</strong></th>
<th align="center"><strong>at</strong></th>
<th align="center"><strong>base64</strong></th>
<th align="center"><strong>base64wide</strong></th>
<th align="center"><strong>condition</strong></th>
</tr>
</thead>
<tbody><tr>
<td align="center"><strong>contains</strong></td>
<td align="center"><strong>endswith</strong></td>
<td align="center"><strong>entrypoint</strong></td>
<td align="center"><strong>false</strong></td>
<td align="center"><strong>filesize</strong></td>
<td align="center"><strong>for</strong></td>
<td align="center"><strong>fullword</strong></td>
<td align="center"><strong>global</strong></td>
</tr>
<tr>
<td align="center"><strong>import</strong></td>
<td align="center"><strong>icontains</strong></td>
<td align="center"><strong>iendswith</strong></td>
<td align="center"><strong>iequals</strong></td>
<td align="center"><strong>in</strong></td>
<td align="center"><strong>include</strong></td>
<td align="center"><strong>int16</strong></td>
<td align="center"><strong>int16be</strong></td>
</tr>
<tr>
<td align="center"><strong>int32</strong></td>
<td align="center"><strong>int32be</strong></td>
<td align="center"><strong>int8</strong></td>
<td align="center"><strong>int8be</strong></td>
<td align="center"><strong>istartswith</strong></td>
<td align="center"><strong>matches</strong></td>
<td align="center"><strong>meta</strong></td>
<td align="center"><strong>nocase</strong></td>
</tr>
<tr>
<td align="center"><strong>none</strong></td>
<td align="center"><strong>not</strong></td>
<td align="center"><strong>of</strong></td>
<td align="center"><strong>or</strong></td>
<td align="center"><strong>private</strong></td>
<td align="center"><strong>rule</strong></td>
<td align="center"><strong>startswith</strong></td>
<td align="center"><strong>strings</strong></td>
</tr>
<tr>
<td align="center"><strong>them</strong></td>
<td align="center"><strong>true</strong></td>
<td align="center"><strong>uint16</strong></td>
<td align="center"><strong>uint16be</strong></td>
<td align="center"><strong>uint32</strong></td>
<td align="center"><strong>uint32be</strong></td>
<td align="center"><strong>uint8</strong></td>
<td align="center"><strong>uint8be</strong></td>
</tr>
<tr>
<td align="center"><strong>wide</strong></td>
<td align="center"><strong>xor</strong></td>
<td align="center"><strong>defined</strong></td>
<td align="center"></td>
<td align="center"></td>
<td align="center"></td>
<td align="center"></td>
<td align="center"></td>
</tr>
</tbody></table>
<p>strings的部分由<code>$</code>后跟一系列字母数字字符和下划线组成，strings可以以文本或十六进制形式定义，示例：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">rule ExampleRule</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $my_text_string = <span class="string">&quot;text here&quot;</span></span><br><span class="line">        $my_hex_string = &#123; E2 <span class="number">34</span> A1 C8 <span class="number">23</span> FB &#125;</span><br><span class="line">    condition:</span><br><span class="line">        $my_text_string <span class="keyword">or</span> $my_hex_string</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<ol>
<li>文本使用引号括起来</li>
<li>十六进制使用大括号（只能是16进制</li>
</ol>
<h2 id="3-1-注释"><a href="#3-1-注释" class="headerlink" title="3.1 注释"></a>3.1 注释</h2><p>跟c语言一样，行注释和段注释都一样。</p>
<h2 id="3-2-Strings"><a href="#3-2-Strings" class="headerlink" title="3.2 Strings"></a>3.2 Strings</h2><h3 id="3-2-1-Hex"><a href="#3-2-1-Hex" class="headerlink" title="3.2.1 Hex"></a>3.2.1 Hex</h3><p>这里其实有三种，文本，十六进制，还有一种是正则。</p>
<p>十六进制可以使用占位符<code>?</code>，通配符使用<code>[]</code></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">$hex_string = &#123; E2 <span class="number">34</span> ?? C8 A? FB &#125;</span><br><span class="line">$hex_string = &#123; F4 <span class="number">23</span> [<span class="number">4</span><span class="number">-6</span>] <span class="number">62</span> B4 &#125;</span><br></pre></td></tr></table></figure>

<p>yara2.0之后可以使用无界跳转：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">FE <span class="number">39</span> <span class="number">45</span> [<span class="number">10</span>-] <span class="number">89</span> <span class="number">00</span></span><br><span class="line">FE <span class="number">39</span> <span class="number">45</span> [-] <span class="number">89</span> <span class="number">00</span></span><br></pre></td></tr></table></figure>

<p>还有一种给定部分的替换方案：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$hex_string = &#123; F4 <span class="number">23</span> ( <span class="number">62</span> B4 | <span class="number">56</span> ) <span class="number">45</span> &#125;</span><br></pre></td></tr></table></figure>

<p>他会匹配：<code>F42362B445 or F4235645</code></p>
<h3 id="3-2-2-Text-strings"><a href="#3-2-2-Text-strings" class="headerlink" title="3.2.2 Text strings"></a>3.2.2 Text strings</h3><h4 id="不区分大小写：nocase"><a href="#不区分大小写：nocase" class="headerlink" title="不区分大小写：nocase"></a>不区分大小写：nocase</h4><p>不区分大小写：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$text_string = <span class="string">&quot;foobar&quot;</span> nocase</span><br></pre></td></tr></table></figure>

<h4 id="宽字节：wide"><a href="#宽字节：wide" class="headerlink" title="宽字节：wide"></a>宽字节：wide</h4><p>如果字符串“Borland”的编码为每个字符两个字节（即B\x00o\x00r\x00l\x00a\x00n\x00d\x00），则以下规则将匹配：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">rule WideCharTextExample1</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $wide_string = <span class="string">&quot;Borland&quot;</span> wide</span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        $wide_string</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>如果要同时搜索ASCII和wide格式的字符串，可以将ASCII修饰符与wide结合使用，先后顺序无所谓：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$wide_and_ascii_string = <span class="string">&quot;Borland&quot;</span> wide ascii</span><br></pre></td></tr></table></figure>

<blockquote>
<p>  默认情况下Text就是ascii的。</p>
</blockquote>
<h4 id="XOR：xor"><a href="#XOR：xor" class="headerlink" title="XOR：xor"></a>XOR：xor</h4><p>以下规则将搜索应用于字符串“This program cannot”（包括明文字符串）的每个单字节XOR：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">rule XorExample1</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $xor_string = <span class="string">&quot;This program cannot&quot;</span> <span class="keyword">xor</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        $xor_string</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>等价于：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">rule XorExample2</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $xor_string_00 = <span class="string">&quot;This program cannot&quot;</span></span><br><span class="line">        $xor_string_01 = <span class="string">&quot;Uihr!qsnfs`l!b`oonu&quot;</span></span><br><span class="line">        $xor_string_02 = <span class="string">&quot;Vjkq\&quot;rpmepco\&quot;acllmv&quot;</span></span><br><span class="line">        <span class="comment">// Repeat for every single byte XOR</span></span><br><span class="line">    condition:</span><br><span class="line">        any of them</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>同样可以结合<code>wide</code>和<code>ascii</code>使用</p>
<h4 id="base64：base64"><a href="#base64：base64" class="headerlink" title="base64：base64"></a>base64：base64</h4><p>以下规则将搜索字符串“此程序无法”的三个base64排列：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">rule Base64Example1</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $a = <span class="string">&quot;This program cannot&quot;</span> base64</span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        $a</span><br><span class="line">&#125;</span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">VGhpcyBwcm9ncmFtIGNhbm5vd</span></span><br><span class="line"><span class="comment">RoaXMgcHJvZ3JhbSBjYW5ub3</span></span><br><span class="line"><span class="comment">UaGlzIHByb2dyYW0gY2Fubm90</span></span><br><span class="line"><span class="comment">*/</span></span><br></pre></td></tr></table></figure>

<p>base64wide修改器的工作方式与base64修改器类似，但base64调整器的结果将转换为wide。</p>
<p>base64和base64宽修饰符还支持自定义字母表，当然字母表长度必须为64</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$a = <span class="string">&quot;This program cannot&quot;</span> base64(<span class="string">&quot;!@#$%^&amp;*()&#123;&#125;[].,|ABCDEFGHIJ\x09LMNOPQRSTUVWXYZabcdefghijklmnopqrstu&quot;</span>)</span><br></pre></td></tr></table></figure>

<h4 id="Searching-for-full-words：fullword"><a href="#Searching-for-full-words：fullword" class="headerlink" title="Searching for full words：fullword"></a>Searching for full words：fullword</h4><p>比如说匹配domain的话，<code>www.mydomain.com</code>这样不会被匹配，但：<code>www.my-domain.com and www.domain.com</code>这样会被匹配</p>
<h3 id="3-2-3-正则"><a href="#3-2-3-正则" class="headerlink" title="3.2.3 正则"></a>3.2.3 正则</h3><p>正则同样可以后面跟nocase，ascii等修饰符</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">rule RegExpExample1</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $re1 = /md5: [<span class="number">0</span><span class="number">-9</span>a-fA-F]&#123;<span class="number">32</span>&#125;/</span><br><span class="line">        $re2 = /state: (on|off)/</span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        $re1 <span class="keyword">and</span> $re2</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>可以在后面结束的斜杠后面加i或者s，用于指定正则表达式不区分大小写。</p>
<p><code>.</code>可以匹配新一行的字符：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">rule RegExpExample2</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $re1 = /foo/i    <span class="comment">// This regexp is case-insentitive</span></span><br><span class="line">        $re2 = /bar./s   <span class="comment">// In this regexp the dot matches everything, including new-line</span></span><br><span class="line">        $re3 = /baz./is  <span class="comment">// Both modifiers can be used together</span></span><br><span class="line">    condition:</span><br><span class="line">        any of them</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>YARA正则表达式识别以下元字符：</p>
<table>
<thead>
<tr>
<th align="center"><code>\</code></th>
<th align="center">引用下一个元字符</th>
</tr>
</thead>
<tbody><tr>
<td align="center"><strong><code>^</code></strong></td>
<td align="center"><strong>匹配文件的开头，或在用作左括号后的第一个字符时，对字符类求反</strong></td>
</tr>
<tr>
<td align="center"><strong><code>$</code></strong></td>
<td align="center"><strong>匹配文件的结尾</strong></td>
</tr>
<tr>
<td align="center"><strong><code>.</code></strong></td>
<td align="center"><strong>匹配除换行符以外的任何单个字符</strong></td>
</tr>
<tr>
<td align="center">**&#96;</td>
<td align="center">&#96;**</td>
</tr>
<tr>
<td align="center"><strong><code>()</code></strong></td>
<td align="center"><strong>Grouping</strong></td>
</tr>
<tr>
<td align="center"><strong><code>[]</code></strong></td>
<td align="center"><strong>Bracketed character class</strong></td>
</tr>
</tbody></table>
<p>以下量词也可以识别：</p>
<table>
<thead>
<tr>
<th align="center"><strong><code>*</code></strong></th>
<th align="center"><strong>Match 0 or more times</strong></th>
</tr>
</thead>
<tbody><tr>
<td align="center"><strong><code>+</code></strong></td>
<td align="center"><strong>Match 1 or more times</strong></td>
</tr>
<tr>
<td align="center"><strong><code>?</code></strong></td>
<td align="center"><strong>Match 0 or 1 times</strong></td>
</tr>
<tr>
<td align="center"><strong><code>&#123;n&#125;</code></strong></td>
<td align="center"><strong>Match exactly n times（精确匹配）</strong></td>
</tr>
<tr>
<td align="center"><strong><code>&#123;n,&#125;</code></strong></td>
<td align="center"><strong>Match at least n times（至少匹配n次）</strong></td>
</tr>
<tr>
<td align="center"><strong><code>&#123;,m&#125;</code></strong></td>
<td align="center"><strong>Match at most m times（最多匹配n次）</strong></td>
</tr>
<tr>
<td align="center"><strong><code>&#123;n,m&#125;</code></strong></td>
<td align="center"><strong>Match n to m times</strong></td>
</tr>
</tbody></table>
<p>以下转义字符可识别：</p>
<table>
<thead>
<tr>
<th align="center"><strong><code>\t</code></strong></th>
<th align="center"><strong>Tab (HT, TAB)</strong></th>
</tr>
</thead>
<tbody><tr>
<td align="center"><strong><code>\n</code></strong></td>
<td align="center"><strong>New line (LF, NL)</strong></td>
</tr>
<tr>
<td align="center"><strong><code>\r</code></strong></td>
<td align="center"><strong>Return (CR)</strong></td>
</tr>
<tr>
<td align="center"><strong><code>\f</code></strong></td>
<td align="center"><strong>Form feed (FF)换页</strong></td>
</tr>
<tr>
<td align="center"><strong><code>\a</code></strong></td>
<td align="center"><strong>Alarm bell</strong></td>
</tr>
<tr>
<td align="center"><strong><code>\xNN</code></strong></td>
<td align="center"><strong>序号为给定十六进制数的字符</strong></td>
</tr>
</tbody></table>
<p>公认字符类：</p>
<table>
<thead>
<tr>
<th><code>\w</code></th>
<th>匹配单词字符 (alphanumeric plus “_”)</th>
</tr>
</thead>
<tbody><tr>
<td><code>\W</code></td>
<td>匹配非单词字符</td>
</tr>
<tr>
<td><code>\s</code></td>
<td>匹配空白字符</td>
</tr>
<tr>
<td><code>\S</code></td>
<td>Match a non-whitespace character</td>
</tr>
<tr>
<td><code>\d</code></td>
<td>匹配十进制数字字符</td>
</tr>
<tr>
<td><code>\D</code></td>
<td>Match a non-digit character</td>
</tr>
</tbody></table>
<h2 id="3-3-Conditions"><a href="#3-3-Conditions" class="headerlink" title="3.3 Conditions"></a>3.3 Conditions</h2><p>conditions就是布尔表达式，and or not ，关系运算符，算数运算符，位运算等。</p>
<p>整数的长度始终为64位，使用位运算符时（例如，~0x01不是0xFE，而是0xFFFFFFFFFE）。</p>
<h3 id="3-3-1-Counting-strings"><a href="#3-3-1-Counting-strings" class="headerlink" title="3.3.1 Counting strings"></a>3.3.1 Counting strings</h3><p>如题，就是计算string的次数，这里使用的是井号</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">rule CountExample</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $a = <span class="string">&quot;dummy1&quot;</span></span><br><span class="line">        $b = <span class="string">&quot;dummy2&quot;</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        <span class="meta">#a == 6 and #b &gt; 10</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>yara4.2.0后，</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#a in (filesize-500..filesize) == 2</span></span><br><span class="line"><span class="comment">//文件最后500个字节中的“a”字符串数必须正好等于2。</span></span><br></pre></td></tr></table></figure>

<h3 id="3-3-2-String-offsets-or-virtual-addresses"><a href="#3-3-2-String-offsets-or-virtual-addresses" class="headerlink" title="3.3.2 String offsets or virtual addresses"></a>3.3.2 String offsets or virtual addresses</h3><p>需要知道字符串是否位于文件上的某个特定偏移量或进程地址空间中的某个虚拟地址，使用at。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">rule AtExample</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $a = <span class="string">&quot;dummy1&quot;</span></span><br><span class="line">        $b = <span class="string">&quot;dummy2&quot;</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        $a at <span class="number">100</span> <span class="keyword">and</span> $b at <span class="number">200</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>at的优先级高于and</p>
<p>at运算符允许在文件或进程内存空间中的虚拟地址的某个固定偏移量处搜索字符串，而in运算符允许在偏移量或地址范围内搜索字符串。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">rule InExample</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $a = <span class="string">&quot;dummy1&quot;</span></span><br><span class="line">        $b = <span class="string">&quot;dummy2&quot;</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        $a in (<span class="number">0.</span><span class="number">.100</span>) <span class="keyword">and</span> $b in (<span class="number">100.</span>.filesize)</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<blockquote>
<p>  可以使用@a[i]获得字符串$a第i次出现的偏移量或虚拟地址。索引是基于1的，因此第一次出现是@a[1]，第二次出现是@a[2]，依此类推。如果提供的索引大于字符串的出现次数，则结果将是一个NaN（不是数字）值。</p>
</blockquote>
<h3 id="3-3-3-File-size"><a href="#3-3-3-File-size" class="headerlink" title="3.3.3 File size"></a>3.3.3 File size</h3><p>直接就是<code>filesize</code></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">rule FileSizeExample</span><br><span class="line">&#123;</span><br><span class="line">    condition:</span><br><span class="line">        filesize &gt; <span class="number">200</span>KB</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h3 id="3-3-4-Executable-entry-point"><a href="#3-3-4-Executable-entry-point" class="headerlink" title="3.3.4 Executable entry point"></a>3.3.4 Executable entry point</h3><p>另个一特殊的变量就是<code>entrypoint</code>，当然，使用这个的前提必须是pe文件</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">rule EntryPointExample1</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $a = &#123; E8 <span class="number">00</span> <span class="number">00</span> <span class="number">00</span> <span class="number">00</span> &#125;</span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        $a at entrypoint</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">rule EntryPointExample2</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $a = &#123; <span class="number">9</span>C <span class="number">50</span> <span class="number">66</span> A1 ?? ?? ?? <span class="number">00</span> <span class="number">66</span> A9 ?? ?? <span class="number">58</span> <span class="number">0F</span> <span class="number">85</span> &#125;</span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        $a in (entrypoint..entrypoint + <span class="number">10</span>)</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h3 id="3-3-5-给定位置的数据访问"><a href="#3-3-5-给定位置的数据访问" class="headerlink" title="3.3.5 给定位置的数据访问"></a>3.3.5 给定位置的数据访问</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">int8(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line">int16(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line">int32(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line"></span><br><span class="line">uint8(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line">uint16(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line">uint32(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line"></span><br><span class="line">int8be(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line">int16be(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line">int32be(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line"></span><br><span class="line">uint8be(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line">uint16be(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br><span class="line">uint32be(&lt;offset <span class="keyword">or</span> <span class="keyword">virtual</span> address&gt;)</span><br></pre></td></tr></table></figure>

<p>举例：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">rule IsPE</span><br><span class="line">&#123;</span><br><span class="line">    condition:</span><br><span class="line">        <span class="comment">// MZ signature at offset 0 and ...</span></span><br><span class="line">        uint16(<span class="number">0</span>) == <span class="number">0x5A4D</span> <span class="keyword">and</span></span><br><span class="line">        <span class="comment">// ... PE signature at offset stored in MZ header at 0x3C</span></span><br><span class="line">        uint32(uint32(<span class="number">0x3C</span>)) == <span class="number">0x00004550</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h3 id="3-3-6-字符串集"><a href="#3-3-6-字符串集" class="headerlink" title="3.3.6 字符串集"></a>3.3.6 字符串集</h3><p>使用<code>of</code>，至少存在字符串集中的一部分。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">rule OfExample1</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $a = <span class="string">&quot;dummy1&quot;</span></span><br><span class="line">        $b = <span class="string">&quot;dummy2&quot;</span></span><br><span class="line">        $c = <span class="string">&quot;dummy3&quot;</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        <span class="number">2</span> of ($a,$b,$c)</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>也可以这样：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line">rule OfExample2</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $foo1 = <span class="string">&quot;foo1&quot;</span></span><br><span class="line">        $foo2 = <span class="string">&quot;foo2&quot;</span></span><br><span class="line">        $foo3 = <span class="string">&quot;foo3&quot;</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        <span class="number">2</span> of ($foo*)  <span class="comment">// equivalent to 2 of ($foo1,$foo2,$foo3)</span></span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">rule OfExample3</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $foo1 = <span class="string">&quot;foo1&quot;</span></span><br><span class="line">        $foo2 = <span class="string">&quot;foo2&quot;</span></span><br><span class="line"></span><br><span class="line">        $bar1 = <span class="string">&quot;bar1&quot;</span></span><br><span class="line">        $bar2 = <span class="string">&quot;bar2&quot;</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        <span class="number">3</span> of ($foo*,$bar1,$bar2)</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>也可以直接使用<code>($*)</code>引用所有字符串，或者可以使用<code>them</code></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">rule OfExample4</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $a = <span class="string">&quot;dummy1&quot;</span></span><br><span class="line">        $b = <span class="string">&quot;dummy2&quot;</span></span><br><span class="line">        $c = <span class="string">&quot;dummy3&quot;</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        <span class="number">1</span> of them <span class="comment">// equivalent to 1 of ($*)</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>还有以下几种：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">all of them       <span class="comment">// all strings in the rule</span></span><br><span class="line">any of them       <span class="comment">// any string in the rule</span></span><br><span class="line"><span class="function">all <span class="title">of</span> <span class="params">($a*)</span>      <span class="comment">// all strings whose identifier starts by $a</span></span></span><br><span class="line"><span class="function">any <span class="title">of</span> <span class="params">($a,$b,$c)</span> <span class="comment">// any of $a, $b or $c</span></span></span><br><span class="line"><span class="function">1 <span class="title">of</span> <span class="params">($*)</span>         <span class="comment">// same that &quot;any of them&quot;</span></span></span><br><span class="line"><span class="function">none <span class="title">of</span> <span class="params">($b*)</span>     <span class="comment">// zero of the set of strings that start with &quot;$b&quot;</span></span></span><br></pre></td></tr></table></figure>

<h3 id="3-3-7-对多个字符串应用相同的条件"><a href="#3-3-7-对多个字符串应用相同的条件" class="headerlink" title="3.3.7 对多个字符串应用相同的条件"></a>3.3.7 对多个字符串应用相同的条件</h3><p>使用的是<code>for...of</code>操作符：</p>
<p><code>for expression of string_set : ( boolean_expression )</code></p>
<blockquote>
<p>  从string_ set中的这些字符串中，至少它们的expression必须满足boolean_expression</p>
</blockquote>
<p>可以使用<code>$</code>来做占位符：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">for</span> any <span class="title">of</span> <span class="params">($a,$b,$c)</span> : <span class="params">( $ at pe.entry_point  )</span></span></span><br></pre></td></tr></table></figure>



<h3 id="3-3-8-使用带of和for-of的匿名字符串"><a href="#3-3-8-使用带of和for-of的匿名字符串" class="headerlink" title="3.3.8 使用带of和for..of的匿名字符串"></a>3.3.8 使用带of和for..of的匿名字符串</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">rule AnonymousStrings</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $ = <span class="string">&quot;dummy1&quot;</span></span><br><span class="line">        $ = <span class="string">&quot;dummy2&quot;</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        <span class="number">1</span> of them</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>



<h3 id="3-3-9-迭代字符串出现次数"><a href="#3-3-9-迭代字符串出现次数" class="headerlink" title="3.3.9 迭代字符串出现次数"></a>3.3.9 迭代字符串出现次数</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">rule Occurrences</span><br><span class="line">&#123;</span><br><span class="line">    strings:</span><br><span class="line">        $a = <span class="string">&quot;dummy1&quot;</span></span><br><span class="line">        $b = <span class="string">&quot;dummy2&quot;</span></span><br><span class="line"></span><br><span class="line">    condition:</span><br><span class="line">        <span class="keyword">for</span> all i in (<span class="number">1</span>,<span class="number">2</span>,<span class="number">3</span>) : ( @a[i] + <span class="number">10</span> == @b[i] )</span><br><span class="line">    	<span class="comment">//也可以这样写</span></span><br><span class="line">    	<span class="comment">//for all i in (1..3) : ( @a[i] + 10 == @b[i] )</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>#a表示$a的出现次数</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">for</span> all i <span class="title">in</span> <span class="params">(<span class="number">1.</span>.#a)</span> : <span class="params">( @a[i] &lt; <span class="number">100</span> )</span></span></span><br><span class="line"><span class="function"><span class="comment">//每次出现都在前100字节内</span></span></span><br></pre></td></tr></table></figure>

<h3 id="3-3-10-Iterators"><a href="#3-3-10-Iterators" class="headerlink" title="3.3.10 Iterators"></a>3.3.10 Iterators</h3><p>yara4.0后<code>for...of</code> 得到了改善</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">for</span> any section in pe.sections : ( section.name == <span class="string">&quot;.text&quot;</span> )</span><br><span class="line"><span class="comment">//等价</span></span><br><span class="line"><span class="function"><span class="keyword">for</span> any i <span class="title">in</span> <span class="params">(<span class="number">0.</span>.pe.number_of_sections<span class="number">-1</span>)</span> : <span class="params">( pe.sections[i].name == <span class="string">&quot;.text&quot;</span> )</span></span></span><br></pre></td></tr></table></figure>



<h2 id="3-4-More-rules"><a href="#3-4-More-rules" class="headerlink" title="3.4 More rules"></a>3.4 More rules</h2><h3 id="3-4-1-Global-rules"><a href="#3-4-1-Global-rules" class="headerlink" title="3.4.1 Global rules"></a>3.4.1 Global rules</h3><p>全局规则允许您同时在所有规则中施加限制。全局规则可以有很多</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">global rule SizeLimit</span><br><span class="line">&#123;</span><br><span class="line">    condition:</span><br><span class="line">        filesize &lt; <span class="number">2</span>MB</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h3 id="3-4-2-Rule-tags"><a href="#3-4-2-Rule-tags" class="headerlink" title="3.4.2 Rule tags"></a>3.4.2 Rule tags</h3><p>这些tag稍后可以用于过滤YARA的输出</p>
<h3 id="3-4-3-Metadata"><a href="#3-4-3-Metadata" class="headerlink" title="3.4.3 Metadata"></a>3.4.3 Metadata</h3><p>没啥说的，上面写了。</p>
<h1 id="4-Modules"><a href="#4-Modules" class="headerlink" title="4.Modules"></a>4.Modules</h1><h2 id="4-1-PE"><a href="#4-1-PE" class="headerlink" title="4.1 PE"></a>4.1 PE</h2><blockquote>
<p>  <a target="_blank" rel="noopener" href="https://yara.readthedocs.io/en/v4.2.3/modules/pe.html">https://yara.readthedocs.io/en/v4.2.3/modules/pe.html</a></p>
</blockquote>
<p>有点多，，没啥写的</p>
<p>后面那个elf也是</p>
<h2 id="4-2-Magic"><a href="#4-2-Magic" class="headerlink" title="4.2 Magic"></a>4.2 Magic</h2><p>就是文件的 magic，可以file命令查看</p>
<p>Magic Module一共两个函数：</p>
<ul>
<li><p>type()：returning a string with the type of the file.</p>
<p><code>magic.type() contains &quot;PDF&quot;</code></p>
</li>
<li><p>mime_type()：returning a string with the MIME type of the file.</p>
<p><code>magic.mime_type() == &quot;application/pdf&quot;</code></p>
</li>
</ul>
<h2 id="4-3-Hash"><a href="#4-3-Hash" class="headerlink" title="4.3 Hash"></a>4.3 Hash</h2><p>不用解释了，，有：MD5，sha1，sha256</p>
<h2 id="4-4-Math"><a href="#4-4-Math" class="headerlink" title="4.4 Math"></a>4.4 Math</h2><blockquote>
<p>  允许您从文件的某些部分计算某些值，并基于这些结果创建签名。</p>
</blockquote>
<h2 id="4-5-Console-module"><a href="#4-5-Console-module" class="headerlink" title="4.5 Console module"></a>4.5 Console module</h2><ul>
<li>log(string)：<code>console.log(pe.imphash())</code></li>
<li>log(message,string)：<code>console.log(&quot;The imphash is: &quot;, pe.imphash())</code></li>
</ul>
<p>后面的参数不止可以string，int，float也可</p>

                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2022/07/27/RC4/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2022-08-13
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/Antivirus/" title="Antivirus">
              <b>#</b> Antivirus
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2022/09/21/2022-9-WinCode1/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#1-YARA%E7%AE%80%E4%BB%8B"><span class="toc-text">1.YARA简介</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#2-YARA%E7%A4%BA%E4%BE%8B"><span class="toc-text">2.YARA示例</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#3-yara%E8%A7%84%E5%88%99"><span class="toc-text">3.yara规则</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#3-1-%E6%B3%A8%E9%87%8A"><span class="toc-text">3.1 注释</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#3-2-Strings"><span class="toc-text">3.2 Strings</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#3-2-1-Hex"><span class="toc-text">3.2.1 Hex</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-2-2-Text-strings"><span class="toc-text">3.2.2 Text strings</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E4%B8%8D%E5%8C%BA%E5%88%86%E5%A4%A7%E5%B0%8F%E5%86%99%EF%BC%9Anocase"><span class="toc-text">不区分大小写：nocase</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%AE%BD%E5%AD%97%E8%8A%82%EF%BC%9Awide"><span class="toc-text">宽字节：wide</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#XOR%EF%BC%9Axor"><span class="toc-text">XOR：xor</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#base64%EF%BC%9Abase64"><span class="toc-text">base64：base64</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#Searching-for-full-words%EF%BC%9Afullword"><span class="toc-text">Searching for full words：fullword</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-2-3-%E6%AD%A3%E5%88%99"><span class="toc-text">3.2.3 正则</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#3-3-Conditions"><span class="toc-text">3.3 Conditions</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-1-Counting-strings"><span class="toc-text">3.3.1 Counting strings</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-2-String-offsets-or-virtual-addresses"><span class="toc-text">3.3.2 String offsets or virtual addresses</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-3-File-size"><span class="toc-text">3.3.3 File size</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-4-Executable-entry-point"><span class="toc-text">3.3.4 Executable entry point</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-5-%E7%BB%99%E5%AE%9A%E4%BD%8D%E7%BD%AE%E7%9A%84%E6%95%B0%E6%8D%AE%E8%AE%BF%E9%97%AE"><span class="toc-text">3.3.5 给定位置的数据访问</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-6-%E5%AD%97%E7%AC%A6%E4%B8%B2%E9%9B%86"><span class="toc-text">3.3.6 字符串集</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-7-%E5%AF%B9%E5%A4%9A%E4%B8%AA%E5%AD%97%E7%AC%A6%E4%B8%B2%E5%BA%94%E7%94%A8%E7%9B%B8%E5%90%8C%E7%9A%84%E6%9D%A1%E4%BB%B6"><span class="toc-text">3.3.7 对多个字符串应用相同的条件</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-8-%E4%BD%BF%E7%94%A8%E5%B8%A6of%E5%92%8Cfor-of%E7%9A%84%E5%8C%BF%E5%90%8D%E5%AD%97%E7%AC%A6%E4%B8%B2"><span class="toc-text">3.3.8 使用带of和for..of的匿名字符串</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-9-%E8%BF%AD%E4%BB%A3%E5%AD%97%E7%AC%A6%E4%B8%B2%E5%87%BA%E7%8E%B0%E6%AC%A1%E6%95%B0"><span class="toc-text">3.3.9 迭代字符串出现次数</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-3-10-Iterators"><span class="toc-text">3.3.10 Iterators</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#3-4-More-rules"><span class="toc-text">3.4 More rules</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#3-4-1-Global-rules"><span class="toc-text">3.4.1 Global rules</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-4-2-Rule-tags"><span class="toc-text">3.4.2 Rule tags</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-4-3-Metadata"><span class="toc-text">3.4.3 Metadata</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#4-Modules"><span class="toc-text">4.Modules</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#4-1-PE"><span class="toc-text">4.1 PE</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#4-2-Magic"><span class="toc-text">4.2 Magic</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#4-3-Hash"><span class="toc-text">4.3 Hash</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#4-4-Math"><span class="toc-text">4.4 Math</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#4-5-Console-module"><span class="toc-text">4.5 Console module</span></a></li></ol></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + YARA%E8%A7%84%E5%88%99 + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2022%2F08%2F13%2F2022-8-13-Yara%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2022/08/13/2022-8-13-Yara/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
